Executive brief
Theme Test Drive is a WordPress plugin that allows site administrators to preview themes. Versions 2.9.1 and earlier contain an unauthenticated local file inclusion vulnerability that allows attackers to read arbitrary files from the web server, potentially exposing sensitive configuration files, database credentials, and source code. This could lead to complete website compromise or data theft without requiring a valid user account.
Technical details
The vulnerability is a local file inclusion (LFI) flaw in Theme Test Drive versions <= 2.9.1 that does not require authentication. The plugin fails to properly validate and sanitize user-supplied input before using it to include files, allowing attackers to traverse the file system and read arbitrary files via a network request. An attacker can exploit this to access sensitive server files such as wp-config.php (containing database credentials), /etc/passwd, or other configuration files. No official patch is currently available; mitigation via web application firewall rules is recommended.
Affected products
- WordPress Theme Test Drive 2.9.1 and earlier
Timeline
- 2026-08-14: disclosed: Published by Patchstack
- 2026-08-18: advisory